TL;DR, What is kube-bench?

kube-bench is an open-source auditing tool from Aqua Security that checks Kubernetes clusters against CIS Benchmarks.

DevOps and security teams often wrestle with hundreds of cluster settings spread across API servers, etcd, controller managers, schedulers, kubelets, and worker nodes. kube-bench removes that manual burden by running each CIS control automatically and flagging misconfigurations before attackers exploit them.

Aqua Security created kube-bench to give enterprises a straightforward way to measure Kubernetes compliance without building custom scripts or frameworks.

Kubernetes Security Best Practices [Cheat Sheet]

This 6 page cheat sheet goes beyond the basics and covers security best practices for Kubernetes pods, components, and network security.

Your work email here

Download cheat sheet

At-a-Glance: 

• GitHub: https://github.com/aquasecurity/kube-bench

• License: Apache-2.0

• Primary Language: Go

• Stars: 7.7k ⭐

• Last Release: August 2025

• Topics/Tags: kubernetes, security, CIS-benchmark, compliance, audit

Common use cases

1. Compliance automation and continuous security monitoring: Organizations wire kube-bench into CI/CD platforms such as Jenkins, GitLab CI, GitHub Actions, and Azure DevOps. Scheduled scans run through CronJobs or pipeline triggers and push reports to dashboards and alerting systems, providing the audit evidence regulators expect without adding manual effort.

2. Pre-production security validation and shift-left security: DevOps teams run kube-bench during cluster provisioning and deployment. A shift-left policy treats failed checks as pipeline blockers, catching issues early and cutting remediation costs. Integrations with infrastructure-as-code workflows keep security guardrails in place whenever cluster definitions change.

3. Incident response and security forensics: Security responders launch kube-bench during an investigation to snapshot the current configuration and spot weak points that may have enabled an attack. Fast baseline comparisons help teams focus on the highest-risk findings and document evidence for post-incident reports.

4. Multi-cluster security governance and standardization: Platform teams overseeing development, staging, and production clusters rely on kube-bench to prove consistent security controls across every environment. Centralized reports give stakeholders clear visibility, even in hybrid or multi-cloud architectures.

5. Security assessment integration with broader toolchains: Mature security programs feed kube-bench output into vulnerability scanners, policy engines, and SIEM platforms. Combined data enables correlation analysis, trend tracking, and unified dashboards that cover multiple risk domains.

How does kube-bench work?

• Test engine: kube-bench reads YAML files that map each Kubernetes version (for example, 1.24) to the matching CIS Benchmark (such as v1.6) and then loads the relevant checks.

• Data collection: kube-bench gathers evidence by reading host file systems, querying the Kubernetes API, and inspecting running processes.

• Multi-mode deployment: kube-bench runs as a Docker container, a Kubernetes Job/CronJob, a standalone binary, or inside a CI/CD pipeline.

• Adaptive architecture: kube-bench limits its scope on managed services such as EKS, AKS, and GKE, concentrating on worker nodes when control plane access is unavailable.

• Reporting module: kube-bench sorts results into PASS, FAIL, and WARN and provides remediation steps for every failed control.

Kubernetes Security for Dummies

Everything you need to know about securing Kubernetes

Your work email here

Download guide

Core Capabilities

1. Automated CIS Benchmark compliance testing: kube-bench links a detected Kubernetes version to the correct CIS Benchmark and runs hundreds of checks across all cluster components. Automated scanning replaces manual audits and delivers consistent results across every cluster and distribution.

2. Multi-platform deployment flexibility: Teams run kube-bench inside a pod, from a Docker container, as a local binary, or as part of pipeline automation. Flexible options fit existing workflows without major infrastructure changes.

3. Comprehensive security reporting and documentation: kube-bench produces detailed reports with benchmark IDs, risk summaries, and fix steps. Outputs suit both human review and machine ingestion (JSON/JUnit), making them useful for dashboards, ticketing systems, and compliance auditors.

4. Version-aware configuration management: YAML test definitions cover multiple Kubernetes and CIS versions, and kube-bench auto-selects the right set at runtime. Teams can add custom checks while staying aligned with industry standards.

5. Managed service compatibility: kube-bench adjusts its tests for EKS, AKS, GKE, and similar services, skipping controls that cloud providers manage and focusing on worker nodes that customers control.

Limitations

1. Scope limited to CIS Benchmarks: kube-bench assesses only CIS Controls. Organizations that need other frameworks must pair it with additional tools.

2. Requires elevated cluster privileges: kube-bench needs access to configuration files and system processes. Highly locked-down environments may block the required permissions.

3. Point-in-time assessments only: kube-bench provides snapshots rather than real-time monitoring. Continuous visibility requires external schedulers or monitoring tools.

4. Manual remediation: kube-bench identifies misconfigurations but does not fix them. Teams must translate findings into corrective actions through separate workflows.

5. Version compatibility dependencies: New Kubernetes or CIS releases demand updated test files. Until maintainers publish those updates, coverage may lag.

Getting Started

Step 1: Download the official job manifest

Clone the kube-bench repo or grab job.yaml from the GitHub releases page.

git clone https://github.com/aquasecurity/kube-bench.git
cd kube-bench

Step 2: Apply the job to your cluster

kubectl apply -f job.yaml

Step 3: Watch the pod until it shows as Completed

kubectl get pods -w

Step 4: Review the results

kubectl logs -l job-name=kube-bench

kube-bench vs. Alternatives

FAQ